CVE-2021-37713

🗓️ 31 Aug 2021 16:50:09Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 207 Views🌐 WEB

npm package "tar" before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability on Windows systems

Reporter	Title	Published	Views	Family All 125
IBM Security Bulletins	Security Bulletin: IBM QRadar Deployment Intelligence app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	24 May 202218:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities	23 Nov 202115:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021	16 Nov 202119:44	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-37713)	22 Apr 202219:42	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability in Node.js tar module affects IBM Cloud Pak for Multicloud Management Managed Services	9 Nov 202118:09	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202318:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar User Behavior Analytics is vulnerable to components with known vulnerabilities	30 Mar 202316:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js	29 Oct 202121:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Machine Learning Accelerator on Cloud Pak for Data is vulnerable to multiple vulnerabilities	12 Dec 202317:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Governance - Identity Manager Virtual Appliance	30 Jun 202305:54	–	ibm

NVD

Vulners

Node

AND

npmjs tarRange<4.4.18node.js

npmjs tarRange5.0.0–5.0.10node.js

npmjs tarRange6.0.0–6.1.9node.js

microsoft windowsMatch-

Node

oracle graalvmMatch20.3.3enterprise

oracle graalvmMatch21.2.0enterprise

Node

siemens sinec_infrastructure_network_servicesRange<1.0.1.1

[
  {
    "product": "node-tar",
    "vendor": "npm",
    "versions": [
      {
        "status": "affected",
        "version": "< 4.4.18"
      },
      {
        "status": "affected",
        "version": ">= 5.0.0, < 5.0.10"
      },
      {
        "status": "affected",
        "version": ">= 6.0.0, < 6.1.9"
      }
    ]
  }
]

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
github	www.github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh
npmjs	www.npmjs.com/package/tar
oracle	www.oracle.com/security-alerts/cpuoct2021.html

Parameter	Position	Path	Description	CWE
entryPath	path	C:some\path	Windows path traversal in tar extraction leading to arbitrary file creation/overwrite and potential code execution in vulnerable node-tar versions.	CWE-22
entryPath	path	C:../foo	Path normalization flaw on Windows allowing traversal via drive-relative paths in tar extraction.	CWE-22

17 Jun 2026 04:01Current

7.3High risk

Vulners AI Score7.3

CVSS 24.4

CVSS 3.18.2 - 8.6

EPSS0.01263

CWE-22